Back to MCP Trust Indexm8ven
45
/ 100
1 month ago
glama

APIFold

Turn any REST API into a hosted MCP server. 18 free public servers (GitHub, Stripe, Slack, OpenAI, Notion, and more) — no setup required, bring your own API key.

→ Work90210/APIFold· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 8 credentials: E2E_RUNTIME_SECRET, E2E_VAULT_SECRET, EMAIL_UNSUBSCRIBE_SECRET, GITHUB_TOKEN, MCP_API_KEY, MCP_RUNTIME_SECRET, MY_TOKEN, VAULT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumturbo@2.3.0GHSA-hcf7-66rw-9f5r

Trubo: Login callback CSRF/session fixation

lowturbo@2.3.0GHSA-3qcw-2rhx-2726

Turbo: Unexpected local code execution during Yarn Berry detection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configABSENT
configAPI_HOST
configCORS_ORIGINS
configCREDENTIAL_TTL_MS
configDATABASE_POOL_MAX
configDATABASE_SSL
configDATABASE_SSL_REJECT_UNAUTHORIZED
configDATABASE_URL
configDRAIN_TIMEOUT_MS
configE2E_DATABASE_URL
configE2E_REDIS_URL
configE2E_RUNTIME_PORT
🔐 secretE2E_RUNTIME_SECRET
configE2E_UPSTREAM_PORT
configE2E_VAULT_SALT
🔐 secretE2E_VAULT_SECRET
🔐 secretEMAIL_UNSUBSCRIBE_SECRET
configFALLBACK_POLL_INTERVAL_MS
🔐 secretGITHUB_TOKEN
configGLOBAL_RATE_LIMIT_MAX
configGLOBAL_RATE_LIMIT_WINDOW_MS
configHEALTH_BIND_ADDR
configHOST
configLOG_LEVEL
configMAX_SSE_SESSIONS
🔐 secretMCP_API_KEY
🔐 secretMCP_RUNTIME_SECRET
configMISSING
configMISSING_VAR
🔐 secretMY_TOKEN
configNEXT_PUBLIC_PLAUSIBLE_DOMAIN
configPLATFORM_DOMAIN
configPRESENT
configPUBLIC_RATE_LIMIT_MAX
configPUBLIC_RATE_LIMIT_WINDOW_MS
configREDIS_MAX_RETRIES
configREDIS_TLS
configREDIS_URL
configRUNTIME_HEALTH_PORT
configRUNTIME_MAX_CONNECTIONS_PER_WORKER
configRUNTIME_MAX_WORKERS
configRUNTIME_PORT
configRUNTIME_SHUTDOWN_GRACE_MS
configSPACED
configSSE_HEARTBEAT_INTERVAL_MS
configSSE_IDLE_TIMEOUT_MS
configUPSTREAM_TIMEOUT_MS
configVAULT_SALT
🔐 secretVAULT_SECRET
configVERSION
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/work90210-apifold-1qnhw8)](https://m8ven.ai/mcp/work90210-apifold-1qnhw8)
commit: ffae6f30e4bae3f0e79369a0452ba81144c0468a
code hash: 1f483f2145fa2620f9fae9f327d21f3817f609538e40b2782109be688001be7f
verified: 6/12/2026, 11:23:05 AM
view raw JSON →